[MODERATED] Re: [PATCH 9/9] TAA 9

[Borislav Petkov <bp@suse.de>]

On Thu, Oct 24, 2019 at 11:10:16AM -0500, speck for Josh Poimboeuf wrote:
> I think this is misleading.  tsx=on doesn't make you vulnerable to TAA,
> because we still the TAA mitigation.

Changed to:

          Therefore TSX is not enabled by default (aka tsx=off). An admin
          might override this decision by tsx=on the command line parameter.
          Even with TSX enabled, the kernel will attempt to enable the best 
          possible TAA mitigation setting depending on the microcode available 
          for the particular machine.

> tsx=on vs tsx=auto is not a security consideration, but rather a
> performance one.  With tsx=auto you disable TSX on some TAA-affected
> CPUs so you don't have to pay the performance penalty of the MDS
> mitigations.

By performance penalty you mean, when you have TSX disabled on those
parts, you'll save yourself the VERW which should be taking care of TAA
too?

> 
> > +
> > +config X86_INTEL_TSX_MODE_OFF
> > +	bool "off"
> > +	help
> > +	  TSX is always disabled - equals tsx=off command line parameter.
> 
> Define "always" :-)

Changed to:

"TSX is disabled if possible - equals to tsx=off command line parameter."

> Not exactly :-)  This also leaves TSX enabled on MDS vulnerable parts.

Your point being, the MD_CLEAR which takes care of TAA too?

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg
--